"Remember Me" Pattern

<?php
// Pseudo-code — assumes $db is a PDO instance

function setRememberMe(int $userId, PDO $db): void
{
    $token    = bin2hex(random_bytes(32)); // 64-char hex token
    $hash     = hash('sha256', $token);    // store hash, not raw token
    $selector = bin2hex(random_bytes(6));  // short identifier to look up row

    // Store selector + hash in DB with expiry (30 days)
    $db->prepare('INSERT INTO remember_tokens (selector, hash, user_id, expires_at)
                  VALUES (?, ?, ?, ?)')
       ->execute([$selector, $hash, $userId, date('Y-m-d H:i:s', time() + 86400 * 30)]);

    // Send selector:token in cookie
    setcookie('remember', $selector . ':' . $token, [
        'expires'  => time() + 86400 * 30,
        'path'     => '/',
        'httponly' => true,
        'secure'   => true,
        'samesite' => 'Lax',
    ]);
}

function loginFromRememberMe(PDO $db): ?int
{
    if (empty($_COOKIE['remember'])) return null;

    [$selector, $token] = explode(':', $_COOKIE['remember'], 2) + ['', ''];

    $row = $db->prepare('SELECT * FROM remember_tokens WHERE selector = ? AND expires_at > NOW()')
              ->execute([$selector]) ? null : null; // simplified

    if (!$row || !hash_equals($row['hash'], hash('sha256', $token))) {
        return null; // invalid or stolen
    }

    // Rotate token
    setRememberMe($row['user_id'], $db);
    $db->prepare('DELETE FROM remember_tokens WHERE selector = ?')->execute([$selector]);

    return (int) $row['user_id'];
}